Turbinia：一款功能强大的自动化云端并行数字取证工具

$turbiniactl –help

usage:turbiniactl [-h] [-q] [-v] [-d] [-a] [-f] [-o OUTPUT_DIR] [-L LOG_FILE]

                   [-r REQUEST_ID] [-R] [-S][-C] [-V] [-D]

                   [-F FILTER_PATTERNS_FILE][-j JOBS_WHITELIST]

                   [-J JOBS_BLACKLIST] [-pPOLL_INTERVAL] [-t TASK] [-w]

                   <command> …

optional arguments:

  -h, –help            show this help message and exit

  -q, –quiet           Show minimal output

  -v, –verbose         Show verbose output

  -d, –debug           Show debug output

  -a, –all_fields      Show all task status fields in output

  -f, –force_evidence  Force evidence processing request inpotentially

                        unsafe conditions

  -o OUTPUT_DIR, –output_dir OUTPUT_DIR

                        Directory path foroutput

  -L LOG_FILE, –log_file LOG_FILE

                        Log file

  -r REQUEST_ID, –request_id REQUEST_ID

                        Create new requestswith this Request ID

  -R, –run_local       Run completely locally without anyserver or other

                        infrastructure. Thiscan be used to run one-off Tasks

                        to process data locally.

  -S, –server          Run Turbinia Server indefinitely

  -C, –use_celery      Pass this flag when using Celery/Kombufor task

                        queuing and messaging(instead of Google PSQ/pubsub)

  -V, –version         Show the version

  -D, –dump_json       Dump JSON output of Turbinia Requestinstead of

                        sending it

  -F FILTER_PATTERNS_FILE,–filter_patterns_file FILTER_PATTERNS_FILE

                        A file containingnewline separated string patterns to

                        filter text basedevidence files with (in extended

                        grep regex format).This filtered output will be in

                        addition to thecomplete output

  -j JOBS_WHITELIST, –jobs_whitelistJOBS_WHITELIST

                        A whitelist for Jobsthat we will allow to run (note

                        that it will not forcethem to run).

  -J JOBS_BLACKLIST, –jobs_blacklistJOBS_BLACKLIST

                        A blacklist for Jobs we will not allow torun

  -p POLL_INTERVAL, –poll_intervalPOLL_INTERVAL

                        Number of seconds towait between polling for task

                        state info

  -t TASK, –task TASK  The name of a single Task to run locally(must be used

                        with –run_local.

  -w, –wait            Wait to exit until all tasks forthe given request

                        have completed

Commands:

  <command>

    rawdisk             Process RawDisk as Evidence

    googleclouddisk     Process Google Cloud Persistent Disk asEvidence

    googleclouddiskembedded

                        Process Google CloudPersistent Disk with an embedded

                        raw disk image asEvidence

    directory          Process a directory asEvidence

    listjobs            List all available jobs

    psqworker           Run PSQ worker

    celeryworker        Run Celery worker

    status              Get Turbinia Task status

server              Run Turbinia Server

https://www.freebuf.com/sectool/199412.html